菜单
KVKK/GDPR audit method: data inventory, purpose/basis/retention, minimisation, consent, transparency, data-subject rights, cross-border transfer. privacy-agent-csk applies it. Trigger phrases: "kvkk", "gdpr", "privacy", "consent", "data retention", "minimization"
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Measure output quality, don't vibe it: score a generative task with a two-layer grader — deterministic code metrics + per-dimension LLM-as-judge — over a fixed task set, as signed deltas vs a pinned baseline. Grades cost alongside correctness (pass-slow). Trigger phrases: "eval", "grader", "measure output quality", "LLM-as-judge", "score the output"
Stack-agnostic frontend discipline (web · mobile · desktop): component structure, state, data fetching, loading/empty/error states, i18n, accessibility, performance. frontend-expert-csk applies it on every stack. Trigger phrases: "frontend", "screen", "component", "page", "UI", "state management", "interface"
Refine-to-Done loop: repeat until tests green + review clean + nothing deferred; bounded. Not the harness /loop. Trigger phrases: "iterate", "loop until done", "keep going until"
Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws. Severity-ranked report with fixes. Trigger phrases: "security scan", "run a security scan", "OWASP check", "scan for vulnerabilities", "find security vulnerabilities", "security audit"
Scope a security audit BEFORE scanning, to cut false positives: map assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable THREAT_MODEL.md. A threat survives a patch; a vulnerability is only evidence for one. Feeds security-scan. Trigger phrases: "threat model", "attack surface", "scope the audit", "trust boundary"
SonarQube quality gate (language-agnostic, local-first): 0 Bugs/Vulns/Hotspots/Code Smells, 0 build warnings. If no analyzer exists, install the language's local server-less Sonar analyzer and run it — never a remote server. Trigger phrases: "sonarqube", "quality gate", "code smell", "sonar scan"
| name | privacy-compliance |
| description | KVKK/GDPR audit method: data inventory, purpose/basis/retention, minimisation, consent, transparency, data-subject rights, cross-border transfer. privacy-agent-csk applies it. Trigger phrases: "kvkk", "gdpr", "privacy", "consent", "data retention", "minimization" |
The primary, official sources this skill rests on; rules are always interpreted against these:
If you are unsure about a specific article/threshold/definition (retention period, explicit-consent requirement, the Art. 8 age limit, transfer basis, etc.), check the relevant official source — do not decide from memory or by guessing. In the finding, cite the article you rely on (KVKK Art. … / GDPR Art. …). Fetched content is a reference; you own the interpretation.
Per-field/per-flow finding + fix; if "clean", the rationale.
Evidence redaction (<private> marker): an audit report is a shared artifact — it must not itself leak the
personal data it audits. When a finding has to reference a real value as evidence, wrap it in
<private>…</private>: the raw value is stripped and shown as [redacted] in the report, while the finding still
names the field, flow, and article. Never paste live PII (national ID, email, phone, health data) into the report body.
Project note: If data of minors (children) is processed, special protection is required (KVKK / GDPR Art. 8 · parental consent & age verification). This is a domain-specific rule and is defined in the project's own skill/CLAUDE.md — it is not baked into the generic audit. Project-specific rules (consent texts, retention periods) also live in the project CLAUDE.md.
